Hacker News Reader

Did they sell it that way?

Or did they simply sell something like "of our 100000 users, 30% bought Lyft rides."?

I mean, I still think it's wrong, but selling who bought what is a bit different than selling how much of a group bought how much of an item.

If all they sold was a count and a percentage, that would be pretty benign. But what are the odds?

Their privacy policy lets them sell individual messages as long as they're scrubbed of "personal information." Where their bar is for that is anyone's guess.

If all they wanted to do was collect and sell aggregate data, you'd think they would say so, and would have reiterated it in their "apology." If they actually gave a shit about their users' personal data, they'd make sure their privacy policy was as restrictive (for the company) as possible while still permitting them to operate.

Slice sells aggregated order data for categories of goods by brand, calculated by looking at email receipts. Things that are useful for calculating overall demand, seasonality, market share, etc. I don't know about selling the actual email content; would be surprised if they did. (Not affiliated with Slice, but am an occasional data buyer, which is how I know of them.)

From their privacy policy:

"We collect such commercial transactional messages so that we can better understand the behavior of the senders of such messages, and better understand our customer behavior and improve our products, services, and advertising. We may disclose, distribute, transfer, and sell such messages...." [emphasis mine]

Of course they might not sell your messages, but it's pretty weird that they'd put up a "we totally can sell your vaguely anonymized messages" and then not take advantage of it. What they sell to Uber may not be what they make available to you.

Even if they don't currently, they could start doing so at any time. And even if you somehow trusted them not to, they could get bought out by someone not so trustworthy.

They could be, no disagreement there.

Now I'm curious: what is the commercial value in the aggregated email content that would make someone want to pay for it, besides the purchase and receipt data that Slice is already providing (plus subscription and open rates)?

Lyft receipts provide origin and destination addresses as well as the exact date and time. That would be tremendously valuable for Uber. That info could be aggregated and then sold to Uber, or their privacy policy would also allow them to just scrub these e-mails (and the manner of scrubbing is not specified, so who knows if they consider the exact origin and destination locations to be personal information or not) and sell them to Uber directly.

Makes sense. The clickstream data that ISPs are now free to sell would be a goldmine then.

Totally! It'll be a golden age for targeted advertising. Maybe less so for the targets of advertising.

You don't know how they sold it and they're certainly not trustworthy enough to believe them even if they say that's the way they did it.

Until all companies that trade in user data are required to disclose how they do so by a regulatory body, and users have an access to an example "slice" of the data being traded, this will continue the way it does, because the incentives are there.

No one would pay for that data

> They don't get it. Their cardinal sin was not failing to disclose how they use your data, although that certainly is a grave sin too. Their cardinal sin was selling their users' e-mails.

I disagree. I think it's fine if a company wants to sell personal emails as long as they are completely up-front about it. But in that case almost nobody will sign up, so the amount of personal data being sold is minimized in either case.

I wouldn't raise a fuss about it in that case, since it's voluntary and so easily avoidable. I'd still call it a "sin," just one that would (I hope) be punished by having nobody sign up.

Let's dispel with this fiction that the companies collecting all this personal data don't know what they're doing. They know exactly what they're doing.